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Quantum key distribution (QKD) allows two spatially separated parties to 
securely generate a cryptographic key. The first QKD protocol, published 
by C. H. Bennett and G. Brassard in 1984 (BB84), describes how this is 
achieved by transmitting individual qubits and exchanging classical authen- 
ticated information. Any attempt to eavesdrop on the protocol introduces 
errors detectable by the legitimate parties. 

This Licentiate Thesis studies the recently introduced EEQKD protocol 
which builds on BB84. In EEQKD, the qubits sent individually in BB84 are 
entangled and thus not directly available to an eavesdropper who is, in this 
protocol, provided only one-by-one access to the transmission. The maxi- 
mal information an eavesdropper can gain using a straightforward intercept- 
resend (IR) attack, is obtained for a given error rate. The secure key gen- 
eration rate of EEQKD is estimated in practical scenarios including qubit 
loss and quantum channel noise. In addition, an exquisite vulnerability 
is exposed: For a particular setting of qubit entanglement, paradoxically 
proving most useful in the face of an IR attack, EEQKD reduces to BB84. 

Part of this research has been published in O. Ahonen et al.. Physical Review 
A 78, 032314 (2008). 
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C. H. Bennett ja G. Brassard julkaisivat vuonna 1984 BB84:ksi kutsutun 
menetelman, joUa toisistaan etaalla olevat osapuolet voivat luoda kryp- 
tografisen avaimen. Menetelma hyodyntaa yksiqubittitilojen ominaisuuksia 
ja autentikoitua klassisten viestien vaihtoa. Kaikki salakuunteluyritykset 
voidaan havaita niiden vaistamatta aiheuttamien virheiden perusteella. 

Tassa lisensiaatintyossa tutkitaan hilj attain esiteltya EEQKD-kvanttiavai- 
menjakomenetelmaa. Sen sijaan, etta yksittaisia hiukkasia lahetettaisiin 
erikseen kuten BB84:ssa, ne ryhmitellaan ja kiedotaan erityisella muun- 
noksella. Kietoutuneet hiukkaset lahetetaan toiselle osapuolelle siten, 
etta salakuuntelu rajoittuu yhteen hiukkaseen kerrallaan, joten se on 
perustavanlaatuisesti rajoittunutta. 

Tyossa lasketaan sieppaus-uudelleenlalietys-hyokkayksella (SUH) 
saatava maksimaalinen tieto avaimesta kvanttikanavassa aiheutetun 
hairion funktiona. Salaisen avaimen muodostamisnopeus arvioidaan 
kaytannon sovellusalaa vastaavissa olosuhteissa, joissa kvanttikanavassa 
on seka haviota etta kohinaa. Lisiiksi naytetaan, miten salakuuntelija 
voi murtaa avaimenjaon BB84-tasolle, kun kaytetaan erasta kietovaa 
muunnosta, joka taas tarjoaa eniten suojaa SUH:ta vastaan. 

Osa tutkimuksesta on julkaistu artikkelissa O. Ahonen et al., Physical Re- 
view A 78, 032314 (2008). 
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Chapter 1 
Introduction 



1.1 Quantum Cryptography 

Cryptography is about concealing the meaning of exchanged messages from unin- 
tended recipients. Today, strong methods are known for this task, such as the Ad- 
vanced Encryption Standard [1]. All cryptographic methods not based on assump- 
tions about the difficulty of certain computational tasks require a cryptographic 
key, a relatively short random bit sequence known strictly only to the sender and 
recipient of the messages. The drawback of these robust encryption methods is the 
requirement of the pre-existing key. 

Quantum cryptography, or synonymously quantum key distribution (QKD), ad- 
dresses the difficulty of agreeing on a cryptographic key which fulfills the require- 
ments of randomness and secrecy. In QKD, these requirements are met based on the 
laws of quantum physics. Notable conceptions in this field include entanglement, the 
no-cloning theorem, and the related effect of unavoidable disturbance of a quantum 
state in acquiring any information about it. Entanglement — the correlation of dis- 
tinct quantum states regardless of their distance inexplicable by classical physics — is 
the main enabler of QKD in protocols such as that proposed by A. K. Ekert in 1991 
(E91) [2]. Besides these so called entanglement-based protocols, the prepare-and- 
measure scheme is another viable approach to QKD [3]. The 1984 protocol by C. H. 
Bennet and G. Brassard (BB84) [4] represents the latter type, and carries the title 
of the first QKD protocol. In BB84, the no-cloning theorem and the unavoidable 
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disturbance of an unknown quantum state upon its measurement assert that the 
key generated by transmission and measurement of qubits, quantum bits, is secure 
after known classical post-processing steps. For a more extensive introduction to 
quantum cryptography, see [5] and references therein. 

This Licentiate Thesis studies the Entanglement-Enhanced Quantum Key Dis- 
tribution (EEQKD) protocol first introduced by the author in Ref. [5] and further 
analyzed in Ref. [6]. The protocol is reviewed briefly in the next section. The main 
results of [5] and [6] are summarized in Ch. 2. Chapter 3 discusses the rate at which 
actual key bits are generated by the protocol in a practical application environment. 
Chapter 4 presents an attack specifically designed for the EEQKD protocol, and 
shows that this attack reduces the EEQKD protocol, with certain parameter values, 
to the BB84 scheme. A preliminary version of this attack was introduced in Ref. [5] . 
Finally, this study and its implications are summarized in Ch. 5. 

1.2 The Protocol 

The EEQKD protocol is a prepare-and-measure-type scheme based on the BB84 
protocol. Entanglement in the protocol was designed not to guarantee the security, 
which is already achieved with the underlying BB84 mechanisms, but to decrease 
the information available to an attacker and thus increase the rate at which the 
key is generated. This Thesis adopts the conventional terminology of QKD: The 
initiator of the protocol is Alice, who wishes to establish a cryptographic key with 
Bob. The attacker, or eavesdropper. Eve attempts to gain as much information on 
the key as possible, without Alice or Bob detecting this. 

Alice and Bob are connected by a quantum channel, i.e., Alice can send qubits 
to Bob. An ideal quantum channel conveys the qubit and its precise state. Eve 
is assumed to be in total control of the quantum channel. In addition, Alice and 
Bob have an authenticated classical channel allowing them to exchange classical 
information such that Eve can only read the messages. Figure 1.1 shows the general 
setup. 

The EEQKD protocol is executed as follows. Alice prepares an A^-bit string 
a = aia2---aN, where each G {0,1} is the outcome of the unbiased binary 



1.2 The Protocol 



3 




Quantum channel 



Figure 1.1: General setup of the EEQKD protocol. Alice and Bob use a two-way 
classical channel and a one-way quantum channel. Eve has total control over the 
quantum channel, whereas she can only listen to the classical channel. 

random variable Ai. String a is the outcome of the composite A^-bit random variable 
A. A large number of such strings forms what is known as Alice's raw key. Alice 
prepares a group of states {|ai; ai), |a2; 02), ■ ' ' y\ci'N', c^n)}, where each G {z,x} 
with uniform probability independently for each bit i. The states |aj; z) and \ai;x) 
are the distinct eigenstates of the Pauli matrices^ cr^ and a^, respectively. These z 
and X bases are denoted {|0), |1)} and {|+) = (|0) + \1))/V2, |-) = (|0) - \1))/V2}, 
respectively. Up to this point, the protocol is identical to BB84. 

Alice applies an A^-qubit transformation Un to the prepared qubit group. She 
then sends the qubits to Bob one by one, always delaying the transmission of the 
next qubit until acknowledgement from Bob of reception, sent via the authenticated 
classical channel. Bob can detect the reception of a qubit without disturbing its 
state by a quantum nondemolition (QND) measurement (see e.g. [7]). Once Bob 
has received and stored the A^ qubits, he applies t/j^ to the group. After this, the 
protocol again proceeds as BB84. 

Bob projectively measures each qubit in the eigenbasis ofaz or ax, chosen indepen- 
dently with uniform probability for each qubit. The measurement results bi G {0, 1} 
from a large number of groups form Bob's raw key. The described quantum trans- 

iThe Pauli matrices are = |0)(1| + |1)(0|, ay = -i\0){l\ + i\l){0\, and cr^ = |0)(0| - |1)(1| 
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Figure 1.2: Quantum circuit for the EEQKD protocol with an intercept-resend 
attack. This circuit generates raw key bits and is thus repeated as many times 
as needed. Bob's quantum nondemolition measurements, acknowledgement of qubit 
reception, and single-qubit memory are not shown. Semicircles represent projective 
measurements in the denoted bases. Gate R{P, 7) is a single-qubit rotation with 
respect to axes y and z, respectively. The Cj are bits in Eve's view of Alice's raw 
key. 



mission phase of the protocol is shown as a quantum circuit in Fig. 1.2. After the 
measurements, Alice and Bob compare their basis choices over the classical authen- 
ticated channel. They discard the bits in their raw keys corresponding to qubits 
transmitted and measured in different bases. The remaining bits, for which the 
transmission and measurement bases coincide, form the participants' sifted keys. 

The sifted keys may still differ due to noise or eavesdropping in the quantum 
channel. Alice and Bob compare a small fraction of the keys, and based on the 
observed differences obtain an estimate of the quantum bit error rate (QBER), 
defined as the average probability of a bit flip in the sifted key. Classical error 
correction procedures (see e.g. [8]) can be applied if the QBER is less than 15%. 
If eavesdropping is suspected, Alice and Bob employ privacy ampliflcation, which 
allows them to reduce any eavesdropper's information to an arbitrarily low value 
while shortening the key. This results in the error-free and sufficiently secret final 
key. For a QBER in the range 15-25% less efficient methods still exist for Alice and 
Bob to arrive at a final key [9]. For an alternative and more verbose description of 
the protocol model, see [5]. 
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1.3 Attacks 

In any attacks against a QKD protocol, the attacker aims at acquiring as much infor- 
mation on the key as possible, while inducing a minimal amount of errors detectable 
to Alice and Bob. The results presented in Chs. 2 and 3 concern the EEQKD pro- 
tocol under an intercept-resend (IR) attack. In the IR attack. Eve captures and 
projectively measures each individual qubit and sends Bob the state correspond- 
ing to her result. In BB84, Eve is able to guess correctly the basis used by Alice 
with probability i, in which case she obtains the correct key bit value. Otherwise 
she gains no information. During the comparison of transmission and measurement 
bases. Eve learns for each qubit if she used the correct basis or not. This leads to 
an average information of 0.5 bits on each sifted-key bit, and a QBER of 25% due 
to the resent state being the correct one with probability 0.5 despite Eve's incorrect 
measurement basis. A detailed calculation is given in Ref. [5]. To induce a smaller 
QBER, Even can choose to interfere only with a fraction ^ G [0, 1] of the transmitted 
qubits. 

An incoherent attack is equivalent to Eve imperfectly cloning each transmitted 
qubit and measuring the clone in the correct basis after receiving the basis infor- 
mation from Alice [10]. Eve can adjust the fidelity of the clone state. The more 
information she gains on the key, the more the QBER increases. For a QBER be- 
low 25%, the incoherent attack provides Eve slightly more information than the IR 
attack. Here, it is more beneficial for Eve to adjust the clone fidelity than to clone 
only a fraction of the qubits. Figure 2.2 illustrates Eve's information as a function 
of the induced QBER for the attacks. 

1.4 Lower Bound on Security 

The security of the BB84 protocol has been proven against an eavesdropper with 
unlimited quantum computing capabilities [11]. This means that Alice and Bob 
can reliably estimate Eve's amount of knowledge on the generated key, and they can 
reduce this knowledge to an arbitrarily small value. The proof given in Ref. [11] holds 
also for more restricted attacks such as IR and incoherent attacks. Furthermore, the 
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proof assumes many realistic imperfections such as noise and loss in the quantum 
channel. 

One may ask whether the addition of gates Un and U\q to the BB84 scheme could 
invalidate the security proof. From Fig. 1.2, it is immediate that in the worst case, 
the added gates are completely under Eve's control. But in this case, the circuit 
represents BB84 under an attack with some 7V-qubit quantum computation, and 
unconditional security for this setting has been proved. Therefore, EEQKD cannot 
be less secure than BB84, in any setting. What is more, calculations of the final 
bit rate, the rate at which bits are acquired for the final key, for BB84 also apply 
to the EEQKD protocol, assuming an ideal quantum channel. That is, in the ideal 
setting, EEQKD cannot perform worse than BB84. Noise and loss in the quantum 
channel can, however, change this as is shown in Ch. 3. 



Chapter 2 



Information Gain of the 
Intercept-Resend Attack 



This Chapter studies the relationship between Eve's knowledge on the generated key 
and the QBER that Alice and Bob observe in the EEQKD protocol. Eve is assumed 
to employ the IR attack, and allowed to perform the included measurements in any 
basis. A definite upper bound to Eve's information is obtained for a given QBER. 
The calculations and results of this Chapter were published in Ref. [6] . Most of the 
calculations are laid out in more detail in Ref. [5]. 



2.1 Attacker's Information 



Let e = 6162 ■ ■ ■ Cat, with each Cj G {0, 1}, denote the outcomes of Eve's measure- 
ments for the entangled group of qubits. The bit string e is the outcome of the 
random variable E. Eve is allowed measurements in any basis, which is equivalent 
to allowing her arbitrary single-qubit gates and measurements in the z basis. Any 
single-qubit gate can be decomposed to Bloch-sphere rotations about the axes y 
and z followed by a phase shift by as e'"^Rz{^)Ry{[3)Rz{pi). To implement an 
arbitrary measurement basis. Eve performs a suitable rotation sequence prior to the 
measurement. Since Eve measures in the z basis, the final rotation as well as the 
phase shift are irrelevant. To minimize the induced disturbance. Eve performs the 
opposite rotations after the measurement which can be assumed projective. Hence, 
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Eve sends qubit i in tlie state 

\^f'"'{Pn)) = [Ry{P)RM]^\euz), (2.1) 

to Bob. If Eve liad someliow learned of anotlier state leading to less errors at Bob's 
end, she would have obtained information on the key bit by some other means 
than the measurement. For individual unentangled qubits, this is not possible and 
resending |\E'f^'^(/5, 7)) is the optimal strategy for Eve. In EEQKD, however, the 
optimal state may depend on Eve's earlier measurement results of the same group. 
We therefore state that this is a good IR attack strategy for Eve, but optimality 
cannot be claimed. This IR attack in EEQKD is shown in Fig. 1.2. 

The random variables A and E allow us to precisely quantify Eve's information on 
the raw key. Since Eve learns which bits of the raw key contribute to the sifted key, 
her knowledge on the sifted key is directly described, as well. The per-bit mutual 
information of A and E is [12] 

I{A, E) = j^[H{A) + H{E) - H{A, E)], (2.2) 

where H{-) denotes the Shannon entropy and H{-, ■) the joint entropy. The mutual 
information or alternatively the entropies are averaged over Alice's basis choices 
a = aia2 ■ ■ ■ CiN which Eve learns during the sifting. The entropies are thus written 
as 

HiE) = ^$^i^a(i^) = -^5^p(e|«)log2P(e|«), (2.3) 

a a,e 

and 

H{A,E) = —J2HaiA,E) = -— ^p(a,e|a)log2p(a,e|a). (2.4) 

a a,a,e 

The entropy of A is constant, H{A) = N. 



2.2 Quantum Bit Error Rate 

The quantum bit error rate is defined as the average probability of a different value 
of one bit, a bit flip, in Alice's and Bob's sifted keys. For each qubit of the qubits 
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in a group, the QBER is 

^ x 1 

QBER,. = -^ 5^p(i?, = a,|A, = a,;aj), j = l,...,N, (2.5) 

where Bj is the random variable describing Bob's measurement of the jth qubit, 
and the bar denotes a bit flip, i.e., the logical not operation. In the following, the 
QBER q is the average of the single-qubit QBER's. 

In practice, Alice and Bob cannot demand that they always observe a zero QBER, 
since various mechanisms of noise in the quantum channel typically lead to q being 
in the range 1-10% even without eavesdropping [13-16]. Hence, Alice and Bob must 
tolerate a finite QBER. Only if q is significantly larger than the estimated value for 
the equipment and the channel, can they be certain that the transmission is being 
eavesdropped. In the IR attack, this means that Eve adjusts the fraction ^ suitable 
for inducing the QBER that Alice and Bob expect. Since it is quite possible for Eve 
to replace a noisy channel with a noiseless one and induce all of the observed QBER 
by eavesdropping, Alice and Bob must attribute all errors to Eve. For a given value 
of q, Eve's maximal information is thus determined by the maximum of the ratio 
I{A,E)/q. 



2.3 Two-Qubit Entanglement: Results 

This section shows Eve's maximal information for a given QBER in the case N = 2, 
i.e., two-qubit entanglement. Gate U2 is decomposed as 



U2 = C{c){ki^i (g) ki^2) = exp 



- (ci iSkJx + C2(Ty ® (Jy + C3 cr^ ® 



{ki,i ® ki,2), 
(2.6) 

where c = (01,02,03) G [0,27r]^^ together with the arbitrary single-qubit gates ki^i 
parametrize the relevant two-qubit gates [5]. In addition, we set ki^i = ki^2, relaxing 
of which can only decrease Eve's maximal information. 

Figure 2.1 shows a full sweep over the parameter space c G [0, 27r]^'^ when Eve 
uses the IR attack in z basis, without single-qubit gates. The upper set of points 
corresponds to Eve measuring both qubits, and the lower to Eve measuring only 
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one of them. As one moves from the topmost to the undermost point of each set, 
the protocol shifts from BB84, where U2 is the identity operator, to the maximally 
entangling EEQKD protocol with 

U2 = C(0, ^, 0) = (/i ® /i + iay ® ay) 7^2, (2.7) 

where Ii is the single-qubit identity operator. It is interesting to note that with 
this gate. Eve's information is strictly zero if she intercepts only one of the qubits. 
Furthermore, it remains zero for any measurement basis. Let U2 denote this gate. 
If Eve measures both qubits, one in basis o"z and the other in ay, her mutual in- 
formation is 0.25, and the QBER is 0.375, which is optimal for Eve. Gate U2 is 
generalized to qubits in Sec. 2.4. 

0.5 

0.4 
5^ 0.3 
^ 0.2 

0.1 


0.1 0.2 0.3 0.4 0.5 
QBER 

Figure 2.1: Eve's information on the key and the induced QBER for different gates 
1/2- Eve uses the IR attack measuring in the z basis. In the upper set, where both 
qubits are intercepted, the information is in the range 0.125-0.5. In the lower set. 
Eve intercepts only one of the qubits, and her information ranges from to 0.25. 

In the following. Eve is allowed to choose her measurement bases freely. To obtain 
the optimal U2, one needs to solve the twofold optimization problem of Alice and 
Bob minimizing Eve's maximal information for a given QBER. In other words, 
the problem is to find miuc max^p^^-y-^^is^^-y^j [H^^ ^"^^ ^^e optimizing parameter 
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values. There are several parameter values solving the problem. One of the optimal 
values for Alice and Bob is 

This yields I{A, E) ^ 0.2237 and q = 0.375, if ^ = 1 and if Eve uses her correspond- 
ing optimal values 7i, /325 72) = (f'O'f'f)- Figure 2.2 shows Eve's maximal 
information as a function of the observed QBER given U2 = C{c*). The informa- 
tion provided by an IR attack in the BB84 protocol is also shown, its explicit formula 
is I{A,E) = 2q. 




0.1 0.2 0.3 0.4 0.5 
QBER 

Figure 2.2: Eve's maximal information on the key as a function of the QBER Alice 
and Bob observe. Eve uses the IR attack choosing measurement bases freely (blue 
lines) or the cloning attack (red dashed line). The dashed lines correspond to BB84 
and the solid line to the EEQKD protocol with the optimal gate U2 = C (|^, . 
The arrow shows how the setting changes from BB84 when the fraction of intercepted 
qubits C, is held constant. For a QBER below 25%, Eve's information is decreased 
by more than 70%. 
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2.4 Gate Construction for N Qubits 

Let us generalize tlie gate f/^, wliicli produces nearly optimal results for Alice and 
Bob in the two-qubit case, to an arbitrary number of entangled qubits A^. Let t/^ 
denote this generalized gate. There are two equivalent choices of different parity 
for the gate for each value of A^. We denote them ^^^^ and f/^odd' both of 
which produce the same maximal information for Eve. We define f/*even ~ -^i ^^"^ 
U'^odd — The (A^ + l)-qubit gate is obtained with the recursive formula 

= ^[h®U'^± KJy ® [PNUt)] , (2.9) 

where = ® /f ^-i if A^ > 2 and Pi = (Xy. Either of the two signs can be 
chosen independently for each step. For instance, the gate given in Eq. (2.7) is 
of even parity, f/^even' produced by the application of the upper sign in the 
formula. The gate U"^ restricts the information gained by any IR attack to at most 
1/(2 A^). A proof of this is given in the Appendix in Ref. [6]. 



Chapter 3 

Key Generation Rate 



This chapter studies the rate at which the EEQKD protocol allows Alice and Bob 
to generate bits for the final key. This final bit rate is arguably the most important 
figure for a QKD protocol once unconditional security has been proven [9]. After 
all, in a practical setting, one would prefer to generate the key as fast as possible or, 
alternatively, use the least necessary technological resources to achieve the required 
key generation rate. Throughout this chapter. Eve is assumed to use the IR attack 
described in Sec. 2.1. 



3.1 Relative Key Rate 

Since the actual final bit rate -Rnet, measured in bits per second, heavily depends on 
the equipment chosen for the realization of the protocol, we use the relative key rate 
r = -RnetZ-Rsift, where -Rsift is the rate at which sifted key bits are generated. The 
relative key rate thus refiects the capability of a protocol to deliver secret, error- 
free bits, independent of the used technology. It allows for the comparison of QKD 
protocols without regard to any specific implementation. 

The exact relative key rate depends on the error correction and privacy amplifica- 
tion procedures applied to the sifted key. It is also a function of the amount of errors 
and their possible correlations in the key, as well as of the amount and structure of 
the information that Eve may have on the key [17]. Therefore, calculation of the 
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exact value of r requires detailed knowledge and assumptions of the protocol and 
the participants' actions during its execution. 

Since we do not wish to fix every smallest detail of the entire key distribution 
procedure, we take the information-theoretic approach [18] to obtain an estimate of 
the relative key rate r. In this paragraph, we follow Ref. [9]. The relative key rate 
is determined by the difference of Bob's and Eve's knowledge of Alice's sifted key as 

r = Rnet/Rsm = I{A, B) - I{A, E). (3.1) 

A non-positive key rate given by this formula might, in some cases, be circumvented 
by advanced techniques. Equation (3.1), however, suffices for our purposes. Errors 
in the quantum channel decrease the correlation of Bob's and Alice's sifted keys. 
Thus, 

I{A,B) = 1-Hun{q), (3.2) 

where the binary entropy 

Hun{q) = -qlog^q- (1 -g)log2(l -g), (3.3) 

and finally, 

r{q) = l-I{A,E)-H^^{q). (3.4) 
In the BB84 scheme, the relative key rate with an IR attack is 

'^BB84(g) = 1 - 2g - Hun{q)- (3.5) 

For the EEQKD protocol. Eve's information provided by an IR attack as a function 
of the QBER q is determined by the slope s of the line shown in Fig. 2.2, i.e., 
s = max [I {A, E)/q], where the maximization is over Eve's parameters for a given 
gate Un- We denote the observed QBER in EEQKD by qE = Sq, and let q denote 
the QBER which the innocent noise of the quantum channel induces with BB84. 
Below, it is demonstrated that the coefficient 6 > 1, i.e., entangling successive qubits 
for transmission can only increase the innocent error rate. The relative key rate is 

ruNiq) = 1- sqE- Hun{qE), (3.6) 
because Alice and Bob must assume that all errors are due to Eve. 



3.2 Quantum Channel Imperfections 



15 



It is convenient to view the effects of different gates U2 with reference to a fixed 
value of q. For this purpose, we define q^d = 6%, which is a typical value for 
the QBER in a BB84-type scheme [13-16]. This value yields a relative key rate of 

rBB84(gref) = 0.553. 

Figure 3.1 shows the relative key rate for the optimized gate U2 = C (|^, 
which yields s = 0.5965 (see Ch. 2). For comparison, the dashed blue line shows 
the rate for a protocol with s = 0. This ideal protocol demonstrates how much 
the general structure of the EEQKD protocol could possibly improve r over the 
BB84 scheme. It provides Eve with no information in the quantum transmission 
phase, that is, its line would, in Fig. 2.2, lie on the horizontal axis. The key rate of 
the ideal protocol is equal to that of BB84 at 6 = 1.555. Therefore, any gate 
that leads to 6 > 1.555 will inevitably perform worse than the plain BB84 scheme, 
unless additional analysis and processing is applied. For the optimized protocol with 
1/2 = the condition for better performance is 5 < 1.323. The QBER 

is fixed at grcf- 

3.2 Quantum Channel Imperfections 

The realization of a quantum channel for QKD has two main alternatives: optical 
fiber and the Earth's atmosphere. The creation of a qubit in a suitable state and 
its detection at Bob's end can be implemented in various ways in both alternatives. 
Most qubit creation methods employ either an attenuated laser or parametric down- 
conversion. Avalanche photodiodes are the most common choice for detecting the 
qubit state. [19] 

Both fiber and atmosphere have two major drawbacks for QKD protocols: The 
quantum channel may lose a qubit altogether, or the state of the qubit may be altered 
such that Bob receives some other state than which Alice sent. These processes 
form the innocent noise of the quantum channel — noise present even without Eve. 
The process of qubit loss is also known as damping or attenuation. In fiber and 
in good atmospheric conditions, the damping is approximately -0.21 dB/km. Poor 
conditions in the atmosphere can raise the damping to a devastating -20 dB/km [19]. 
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Figure 3.1: Relative key rate as a function of the coefficient 6 by which the use 
of an entangling gate changes the observed QBER. The QBER in BB84 is fixed 
to gref = 6%. The EEQKD protocol is shown in solid line for U2 = C{c*). The 
blue dashed line shows the maximal rate for the EEQKD protocol, corresponding to 
s = 0. The relative key rate of the BB84 protocol is 0.553, shown in red dash-dotted 
line. The vertical green dotted lines mark 6 for the gate f/* with noise operators 
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Change of tlie qubit state during transmission contributes to tlie QBER, for which 
typical values range from 1% to 10% [13-16]. 

Let us quote the damping values reported in a recent QKD experiment carried 
out over a distance of 144 km in the atmosphere [16]. The total damping for single 
photons in the channel was typically -30 dB, which means that only 0.1% of photons 
transmitted reached the detector at Bob's end. The atmosphere contributed between 
-8 and -12 dB, photons not hitting the receiver between -10 and -16 dB, and optics 
-2 dB in total. The atmospheric damping is thus -0.07 dB/km. For instance, with 
the setup of [16], a distance of 10 km would lead to a damping of -(0.7 dB + 2 dB) 
~ -3 dB, which means that only half of the qubits would reach Bob's detectors, on 
average. 

3.3 Effect of Noise 

To obtain an estimate for the coefficient 6 by which the EEQKD protocol increases 
the QBER relative to BB84, we assume that the quantum channel acts indepen- 
dently on each transmitted qubit with one of the two unitary noise operators 

N.yz{n) = [(1 - n)h + n{a^ + ay + a,)]/V4n^ - 2n + 1, (3.7) 

and 

Na:z{n) = [(1 - n)h + n{a^ + a,)]/V3n^-2n + l, (3.8) 
where n is the amplitude of the noise. 

With the noise operator Nxyz{n), we obtain a mapping between the QBER in the 
BB84 scheme q and the amplitude n through numerical calculation. The mapping 
is shown in Table 3.1. Once the amplitude n is known for each value of q, it is 
straightforward to calculate the corresponding QBER in EEQKD, qE = Sq. Note 
that S and thus qE depend on the gate Un chosen by Alice and Bob. 

3.3.1 Gate U} 

Let us study the gate U*, defined in Sec. 2.3, under the above noise operators in 
more detail. Numerical calculation shows that the coefficient 6 is exactly 2(1 — q) 
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Table 3.1: Mapping between tlie amplitude n of the quantum channel noise operator 
Nxyz{n) and the QBER the operator induces in the BB84 scheme. 



q 2% 


4% 


6% 


8% 


10% 


12% 


25% 


50% 


n 0.0922 


0.1274 


0.1537 


0.1758 


0.1952 


0.2129 


0.3091 


0.5000 



and thus the resulting QBER due to noise is 

gr° = 2(g-g'), (3.9) 

provided that the noise operator is ^xyzip)- For the noise operator N^zin), the 
calculation yields an even higher QBER, namely 

= 3g - 4g2. (3.10) 

For the highest sensible error rate value q = 0.5, both operators yield q]^^'^^ = 0.5, 
as is expected. If g = gref, the coefficient is 6 = 1.88 for the operator Nxyz{n) and 
6 = 2.76 for Nxz{n). These values are shown in Fig. 3.1, which demonstrates that 
the relative key rate is lower than that of BB84, if g = gref- 

The relative key rate is 

2 

^ut^^) = 1 - 3?i? - HuniqE), (3.11) 

since the maximized slope is s = = |. The rate is plotted in Fig. 3.2 as a funtion 
of g for the two defined noise operators. The BB84 scheme, shown in dashed line in 
Fig. 3.2, yields a positive key rate up to g = 17.05%. Gate f/^ yields a positive rate 
if g < 15.36% or g < 10.00% for quantum channel noise given by N^yzin) or N^zin), 
respectively. The rate is, however, lower than that of BB84. 

A positive key rate is possible with BB84 up to g = 25%, in which case more 
complex methods of quantum privacy amplifiction or classical advantage distillation 
must be used [9]. Whether the same holds for gate U2, or for the EEQKD protocol 
in general, remains to be studied. 

If qubit loss remains at a tolerable level, it is possible that the EEQKD protocol 
with gate U2 performs better than the BB84 scheme at large error rates. Unfortu- 
nately, the practical situation for QKD at present is the opposite: Qubit loss is very 
high, of the order of 0.999, and the error rate is quite small. 
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Figure 3.2: Relative key rate under quantum channel noise for the gate as a 
function of the QBER in BB84. The rate for the BB84 scheme is shown in dashed 
line, it is positive for q < 17.05%. The upper blue line corresponds to the noise being 
due to operator N^yz, and the lower red line due to N^z- The rates are positive for 
q < 15.36% and q < 10.00%, respectively. 
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3.4 Effect of Qubit Loss 

In the BB84 scheme, the effect of qubit loss is to simply reduce the amount of bits 
in the sifted key by one for every photon lost in the quantum channel. In EEQKD 
however, the loss of one qubit in general affects the other entangled — 1 qubits, 
as well. Thus, qubit loss increases the QBER of the remaining qubits. 

This section studies the effect of qubit loss in the case where exactly half of the 
transmitted qubits are lost in the quantum channel. This roughly corresponds to a 
transmission distance of 10km, as discussed in Sec. 3.2. We also make the reasonable 
assumption that the probability of loss, 0.5, is uniform and independent for each 
qubit. For simplicity, we set N = 2, i.e., study two-qubit entanglement. 

If qubit loss is 50%, the probability for a qubit pair, entangled or not, to lose both 
of its qubits is 0.5 x 0.5 = 0.25. Symmetrically, the probability that neither qubit is 
lost is 0.25. The probability to lose exactly one qubit is 0.5. Entanglement between 
the qubits does not affect loss, as is demonstrated by the expected number of lost 
qubits: 2 x 0.25 + 1 x 0.5 = 1 for a pair of qubits. 

Entanglement does, however, affect the change of the state of the remaining qubit 
if exactly one qubit is lost. Let gioss denote the QBER of the remaining qubit due to 
loss of the other. Let us optimistically assume that quantum channel noise induces 
the same QBER as in BB84, denoted q, for the remaining qubit. The total QBER 
of the remaining qubit is obtained as the exclusive-or of the two probabilities gioss 
and q. It is 

ftoss = ? + gioss - 2ggioss . (3.12) 

That is, a bit flip is due to noise or loss of the other qubit, but not both (since then 
the bit value would be correct). Only half of the transmitted qubit pairs lose exactly 
one qubit. The qubit pairs transmitted without loss contribute two bits per pair to 
the raw key. Their QBER g^"''''^ may differ from q. The overall average QBER is 
thus 

qE = (gr" + Q + Hoss - 2ggioss)/2. (3.13) 

To simulate the effect of qubit loss. Bob may be assumed to replace each lost qubit 
with a constant state, e.g., |0). 
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Figure 3.3 shows qE for different values of the gate parameter C2- This specific 
parameter was chosen because varying it between and | covers most of the relevant 
gates Un and corresponds to a shift from the BB84 scheme to using gate U^. The 
other two parameters are fixed to ci = C3 = 0. Noise is given by Eq. (3.7). For 
g = 0, shown in dashed line, the overall average QBER increases from to 25%. For 
q = grcf, shown in solid line, qE increases from grcf to 30.64%. The dash-dotted line 
corresponds to g = 10%, and yields a qE between 10% and 34.00%. With f/^, the 
effect of qubit loss is devastating: The remaining qubit of a pair of which the other 
qubit is lost, is completely scrambled, i.e., gioss = 0.5. For the optimized gate C(c*) 
defined in Sec. 2.3, qE = 21.37% for g = and qE = 26.86% for q = 6%. To conclude, 
the error rate induced by qubit loss can be very high and can thus decrease the key 
rate in EEQKD significantly, in addition to decrease due to quantum channel noise. 
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Figure 3.3: Total average QBER as a function of the gate parameter C2 for 50% 
qubit loss. The other gate parameters Ci = C3 = 0. The QBER in BB84 is zero for 
the blue dashed line, 6% for the red solid line, and 10% for the black dash-dotted 
line. At C2 = 0, the protocol is equivalent to BB84, and at C2 = 7r/2 ^ 1.57, the 
gate is f/^. 
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3.5 Optimizing the Key Rate 

3.5.1 Rate without Qubit Loss 

We maximize the two-qubit relative key rate ru^iQ) for various values of the BB84 
QBER q. The optimization is performed over the entangling gate parameters c. The 
slope s is the maximum obtained by optimization over Eve's parameters. Quantum 
channel noise, given by Eq. (3.7), is taken into account with the approach described 
in Sec. 3.3. We assume no loss of qubits in the quantum channel. 

In addition to random initial values of c and random identical single-qubit gates 
before gate C{c), we start the optimization at U2 = I2 (the BB84 scheme), at 
U2 = U2, and at c = c*. We iterate the optimization for this array of initial values 
over the q values of 2%, 4%, 6%, 8%, 10%, 12%, and 25%. 

For all the employed values of q, gate C (f , f, f ) yields the highest relative key 
rate. Figure 3.4 shows the rate for this gate for the various values of q, denoted with 
circles, and for BB84 in blue dashed line. For q = 25%, the optimal gate yields a 
key rate of —0.02. The negativity of the rate is a symptom of the fact that more 
advanced post-processing methods are required, even in the plain BB84 scheme. 
This setting is, however, irrelevant in the practical situation, where the QBER is 
significantly lower. 

3.5.2 Rate with Qubit Loss 

We repeat the optimization procedures described in the previous section for a lossy 
quantum channel. We use Eq. (3.13), i.e., take into account quantum channel noise, 
given by Eq. (3.7), and qubit loss, which is fixed to 50%. 

For QBER's in the range 2-12%, the optimization did not reveal any gates which 
would yield a higher key rate than BB84; successful maximizations terminated at the 
gate being the identity operator. For q = 25%, we were able to find a gate yielding 
a key rate of —0.16, which is higher than that for BB84. Again, the negativity of 
the rate shows that more advanced post-processing methods are required for large 
values of QBER. 
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Figure 3.4: Relative key rate as a function of tlie QBER in BB84. Quantum channel 
noise is given by the operator N^yzin), and no qubit loss is assumed. The circles 
denote the rate for the optimal gate C (f , f , f ) at the discrete values of QBER for 
which the rate was maximized, and the solid line is drawn to guide the eye. The 
BB84 scheme is shown in blue dashed line. 
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3.5.3 Correlated Bit Errors 

For highly entanghng gates, the bit errors of an entangled pair are expected to be 
correlated. Let us optimistically assume that the errors are fully correlated. Then, 
the amount of bits exchanged, and thus disclosed to Eve, in the error correction 
phase is halved. This is reflected in the relative key rate as 

r^;^(g) = l-sg^-^i7binfe), (3.14) 

since Eve's information is now sqE + \H\^\n{(lE) , the sum of information obtained via 
eavesdropping and by listening to the classical error correction procedure [17]. 

We repeat the optimization procedures described in Sec. 3.5.1 with the assumption 
of a 50% qubit loss and using the key rate given by Eq. (3.14). The end result is the 
same as in Sec. 3.5.2: For a QBER in the range 2-12%, BB84 yields the highest key 
rate, and for q = 25%, there is a non-identity gate yielding the highest rate. The 
latter is achieved approximately at c = (0.11, 0.89, 0.10), with a relative key rate of 
0.30. This gate, however, gives no particular justification to assume full correlation 
of errors in the entangled qubit pair. 

Correlation of errors is not a reasonable assumption with BB84, either. Let us 
therefore compare the relative key rate of Eq. (3.14) for gate f/^, which is expected 
to provide at least some correlation of errors, with the rate of Eq. (3.5) for the BB84 
scheme. Figure 3.5 shows these rates as a function of q, assuming quantum channel 
noise given by Eq. (3.7) and a 50% qubit loss. Gate U2 assuming full correlation 
of errors is shown in red solid line, while BB84 assuming no correlation is shown 
in black dash-dotted line. The former yields a higher key rate for approximately 
q > 10.5%. The rate also seems to remain positive when the QBER increases. The 
blue dashed line shows the rate for t/* without any correlation of errors. This rate 
is negative for approximately g > 1%. 
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Figure 3.5: Relative key rate as a function of the QBER in BB84. Quantum channel 
noise is given by the operator N^yzin), and qubit loss is fixed to 50%. The rate for 
gate U2 assuming full correlation of errors in qubit pairs is shown in red solid line 
and without any correlation of errors in blue dashed line. The BB84 scheme, without 
any correlation of errors, is shown in black dash-dotted line. The BB84 scheme yields 
a higher key rate for approximately q < 10.5%. 




Chapter 4 

Entanglement-Enhanced Attacks 



This chapter presents the entanglement-enhanced (EE) attack against the EEQKD 
protocol for two- and three-qubit entanglement. The attack is based on Eve locally 
manipulating entangled qubits, one or more of which are already in Bob's possession. 
For the gates f/^ and U^, defined in Sec. 2.4, the EE attack reduces the EEQKD 
protocol to BB84. Here, Eve utilizes A^-qubit entanglement to fully counteract the 
restriction posed by Alice and Bob's use of A^-qubit entanglement. The two-qubit 
EE attack was partially developed in Ref. [5]. 

The technological requirements for the attack are a subset of those for Alice and 
Bob. Eve needs to utilize short-term quantum memory, perform projective measure- 
ments as well as quantum non-demolition measurements to detect the presence of 
an intercepted qubit. In addition. Eve needs to apply single-qubit gates chosen from 
a small set of gates, and she needs to be able to repeatedly construct a constant 
entangled state of two or three qubits. The latter requirements translate to the 
application of a local A^-qubit gate and to applying an entangling A^-qubit gate to 
a constant state. 

4.1 Two-Qubit Protocol 

For clarity of presentation and without loss of generality, we assume that Alice and 
Bob have chosen t/^^en ^^e gate [/^. The superscript '-I-' denotes the sign chosen 
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in Eq. (2.9). Changing the parity or the sign of f/* is accommodated by straight- 
forward changes of sign and bit value in Eve's actions. The states transmitted by 
Alice are 

U*\ai; ai)\a2; 02) = 0«i«2) ± (-l)"^+"^i|aia2)] /V2, (4.1) 

where the upper sign is chosen if and only if ai 7^ a2- The bases ai and a2 are 
unchanged, and omitted to enhance readability on the right-hand side of Eq. (4.1). 
Furthermore, we have employed the notation {ip) ® Iv^) = = {"ipy^)- 

4.1.1 Obtaining the Qubit Pair 

To begin the attack. Eve captures the first, i.e., left-slot, qubit of the state in 
Eq. (4.1) and stores it in quantum memory. She then sends the left-slot qubit of the 
EPR state 

|Eve°) = (|0)|0)-z|l)|l))/V2 (4.2) 

to Bob, who acknowledges receiving it, thus triggering Alice to send the second, 
right-slot, qubit of the state in Eq. (4.1) to Eve. Having received both qubits. Eve 
applies f/^^ to the qubit pair, and is now in possession of the state |ai; ai)|a2; a2). 

4.1.2 Measurement and Entangled- State Reconstruction 

Eve measures the product-state qubits in the eigenbasis. Depending on the 
individual results ei and 62 from the left- and right-slot qubits, respectively. Eve 
applies the single-qubit operator 

Ee,e, = i-tayy'{ia^y\ (4.3) 

to the right-slot qubit of Eq. (4.2). She then sends this qubit to Bob, who has the 
state 

ih ® ^eiej |Eve°) = (|eie2) - (-l)^^+^^z|eie2)) /V2. (4.4) 
That is. Eve is able to send the state f/;^|ei; z)\e2] z) to Bob. 
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4.1.3 Mutual Information and QBER 

Bob applies U2 to the received entangled qubit pair, hence obtaining the state 
|ei; z)\e2', z). This shows that the EEQKD protocol has been reduced to BB84, and 
the effect of the attack is the same as an IR attack in BB84. With probability |, the 
bases ai = a2 = z and Eve gains full information on the bit values while inducing 
no errors. With probability |, exactly one of the two bases is z and Eve gains 0.5 
information and induces a 25% QBER, on average. With probability |, the bases 
«i = «2 = X, in which case Eve gains no information and induces an average QBER 
of 50%. The expected values of information gain and QBER are thus 0.5 and 25%, 
respectively. 

4.2 Three-Qubit Protocol 

For clarity of presentation and without loss of generality, we again assume that Alice 
and Bob have chosen U'^^^n the gate . Changing the parity or the signs of 
is accommodated by straightforward changes of sign and bit value in Eve's actions. 
In this case, Alice transmits states 

t/*|ai; ai)|a2; a2)|a3; as) = 

^ [|«i«2a3) ± (-l)'^^+"=*z|aia2a3) ± {-iT'^^'Hla^a^a^) T (-l)'^^+"^|aia2a3)] , (4.5) 

where the upper sign is chosen for the second term iff ^2 7^ ^3, for the third term 
iff «! 7^ 02, and for the fourth term iff ai 7^ 0:3. The bases ai, 02, and are 
unchanged, and again omitted to enhance readability on the right-hand side of 
Eq. (4.5). 

4.2.1 Processing the First Two Qubits 

To begin the attack. Eve captures the left-slot qubit of the state in Eq. (4.5) and 
stores it in quantum memory. She then sends the left-slot qubit of the state 

|Eve°) = \ (|0)|0)|0) - .|0)|1)|1) - ^|1)|1)|0) + |1)|0)|1)) , (4.6) 
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to Bob, who acknowledges receiving it, thus triggering Alice to send the second, 
middle-slot, qubit of the state in Eq. (4.5) to Eve. Having received the first two 
qubits. Eve applies to them the operation —{ay ® A)f^2'etcn- The full operation 
applied to the initial product state \ai; ai)\a2; a2)|a3; as) so far is 

{ [-{ay ® /i)f/2*even] ® h } = {h ®h®ay- ih ®ay®Ii)/V2 = Ii0 U^^^^. 

(4.7) 

Therefore, the first, left-slot, qubit of the transmitted state is unentangled from 
the other two. This enables Eve to measure the first qubit in the z basis without 
interfering the last two qubits. Eve stores the received middle-slot qubit in quantum 
memory. If and only if the result ci of the first measurement is 1, Eve applies a^ to 
the middle-slot qubit of Eq. (4.6). She then sends the qubit to Bob. 

4.2.2 Processing the Last Two Qubits 

Bob's reception of the second, middle-slot qubit, triggers Alice to send the last, 
right-slot qubit to Eve. As shown in Eq. (4.7), the last two qubits are now in state 
^2 oddl'^2; ^2) l^; as)- Eve applies U^^^^ to this state, and measures the qubits 
1*22; 0^2) and las; 03) in the z basis. Let 62 and 63 denote the measurement results, 
respectively. 

The single-qubit gate to be applied to the last qubit of Eq. (4.6) depends on all 
three results ei, 62, and 63. If ei = 0, the operation is equal to that of the two-qubit 
case, {—iayY^{iaxY^ . If ei = 1, the operation is iay{—iayY^{—iaxY'^- Hence, the 
full operation applied to the state [Eveg) is 

Ee,e,e, = h® {a^Y' ® %,fl{-i<yyY' {^<^^Y' + 5e,Aiay{-iayY' {-la^Y'] , (4-8) 

where 5r,v is the Kronecker delta. These single-qubit operations allow Eve to send 
the state U^\ei] z)\ei\ -z)|e3; z) to Bob. 

4.2.3 Mutual Information and QBER 

Bob applies U^'^ to the received entangled qubit triplet, and thus obtains the state 
\e\\ z)\e2'i z)\e^'i z). This shows that the EEQKD protocol has been reduced to BB84, 
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and the effect of the attack is the same as an IR attack in BB84. The calculation 
of Eve's mutual information and the induced QBER is similar to that presented in 
Sec. 4.1.3. On average, Eve gains 0.5 bits of information per key bit and induces an 
average QBER of 25%. 



Chapter 5 
Conclusions 



This Licentiate Thesis presentes an in-depth investigation of the EEQKD protocol, 
which is based on transmitting A^-qubit entangled states. It is shown that the 
protocol cannot be less secure than the well-known BB84 protocol, on which EEQKD 
is based. We have shown that by entangling the qubits optimally, it is possible to 
significantly reduce the maximal information provided by an intercept-resend attack 
for a given error rate. We have presented an A^-qubit gate, U^, which restricts the 
information gain of an IR attack to at most 1 / (2A^) . 

Chapter 3 discusses the arguably most important figure for a QKD protocol, the 
key generation rate, in the case N = 2. A model is developed for the inherent noise 
in the quantum channel, and the effect of this noise to the key rate is estimated. 
The loss of qubits in the quantum channel also strongly affects the key rate. The 
effect is estimated for a 50% loss, roughly corresponding to a transmission distance 
of 10km. It is shown that at least for gate parameter values near c = (0, |, 0), i.e., 
gate U2, the combined effect of noise and loss makes the error rate prohibitively 
large. 

The relative key rate was maximized over the entangling gate U2 for various 
values of the qubit error rate, taking into account quantum channel noise. Without 
qubit loss, the gate C (f,f,f) allows for fastest key generation. The key rate is 
between 3% to 35% higher than that of BB84 for typical values of the qubit error 
rate, and the difference increases with the error rate. Errors or loss introduced by 
the additional equipment of the EEQKD protocol were not taken into account. An 
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extensive effort was made to find a gate U2 yielding a higher key rate than BB84 with 
noise as well as qubit loss, but no such gate was discovered. This study conclusively 
shows that in present day practical applications, BB84 performs better than the 
EEQKD protocol — increasing entanglement between consecutive qubits decreases 
the key rate. 

For highly entangled qubit pairs, the bit errors may be correlated. If this is taken 
into account in the protocol, it may reduce the information leaked to an attacker 
in the error correction phase. For N = 2, the correlation ideally halves the leaked 
information. It is shown in Sec. 3.5.3, that gate U2 could yield a higher key rate 
than BB84 for error rate values larger than 10.5%, if full correlation of errors is 
assumed. This is in spite of the detrimental effects of quantum channel imperfections 
in particular for the gate ?7^. 

A novel attack against the EEQKD protocol was developed based on an earlier 
partial presentation. An attacker is able to reduce the EEQKD protocol to the BB84 
protocol at least for the gates U2 and U^. It is expected that the attack generalizes 
to an arbitrary value of A^, but for values of the gate parameter C2 between and | 
the generalization is unlikely. This is because the absolute values of the amplitudes 
of the superposition states are unequal for these gates, and the amplitudes cannot 
be altered with the approach discussed. However, the attack may provide more 
information than an IR attack for other gates, as well. It is not surprising that the 
key to Eve's overcoming of the inaccessibility to the full multi-qubit entangled state 
lies in the equally clever use of entangled qubits. 

Although the results in Ch. 2 strongly suggest that the protocol performs better 
than the BB84 scheme, the studies regarding the key generation rate, in Ch. 3, in 
fact show that the opposite may be true. In practical key distribution applications 
at present, one cannot recommend the use of EEQKD over BB84. In the scenario of 
very low qubit loss, however, the EEQKD protocol may perform better, especially 
if the qubit error rate is relatively high. Furthermore, the attack described in Ch. 4 
allows Eve to reduce EEQKD with to the plain BB84 scheme, at least in the 
case of two or three qubit entanglement. This raises the question whether the attack 
can be modified to overcome any entangling gate. 

Correlation of bit errors in entangled qubits warrants further study. High correla- 
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tion of errors in an A^-qubit group would significantly reduce the information leaked 
in error correction, which is the main contributor to the decrease in the key rate of 
the EEQKD protocol. Unless full correlation is achieved, the protocol needs to be 
amended to take the correlation into account properly. 

We have shown that full correlation of bit errors could result in a key rate above 
that of the BB84 scheme, if the underlying error rate is high. This, however, only 
applies to a fairly low value of qubit loss, 50%. In a realistic scenario, the loss is of 
the order of 0.999 for transmission distances beyond 100km. Therefore, developing 
states robust to qubit loss is a topic for future research. The difficulty here lies in 
balancing the need to protect the transmission from an attacker with the need to 
tolerate uncontrolled loss of qubits. 

In the course of this study, it has become manifest that it is usually beneficial for 
an attacker to measure all the qubits of an entangled state, as opposed to measur- 
ing only a fraction of qubits in each group. Hence, interleaving and randomizing 
the qubits of different entangled groups for the transmission could improve the 
information-error ratio. This is yet another topic for future research. 



Appendix A 

List of Source Code Files 



This appendix lists and briefly delineates the flies containing the source code used 
to perform the calculations presented in this thesis. A more detailed description is 
given in each flle. File names ending with '.m' are scripts or functions for Matlab by 
The MathWorks, Inc., and those ending with '.nb' are notebooks for Mathematica 
by Wolfram Research, Inc. 

init2.m initializes the two-qubit BB84 states in the array msg. 

appIySU2fuIl.m applies a single-qubit gate (SU2 matrix) to one of the qubits of 
each pair in the array msg. 

A.m applies gate C(c) to each of the states in the array msg. 

appIySU2.m applies successive z and y rotations to one of the qubits of each pair 
in the array msg. 

measurel.m gives the single-qubit projective measurement operator for the given 
result and basis. 

measure2.m gives the two-qubit projective measurement operator for the given 
results and bases. 

summsgs.m sums over different values of a in the probability matrix of Bob's 
results for given a and e. 
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bb84e34.m calculates the mutual information and QBER for given gate parameters 
for Alice and Bob's and Eve's gates. 

slopebb84e34.m returns the slope I{A,E)/q for the given gate parameters for 
Alice and Bob and for Eve. 

bb84emaxeve34.m maximizes the slope 9 times over Eve's parameters and returns 
the maximal value found. 

bb84eminmax34.m minimizes the slope over Alice and Bob's parameters and 
returns the minimal slope and the corresponding parameters. 

A3.m applies gate C(c) to the two rightmost states in each three-qubit state given 
parameter. 

bb84e40q.m simulates the protocol under photon loss. The first entangled photon 
is replaced with the given state. Returns only the QBER's of the two qubits 
and their average. 

applynoise.m applies the noise operator N^yz to the specified qubit in each of the 
pairs in the array msg. 

bb84e60.m simulates the protocol under innocent quantum channel noise with a 
given amplitude. Returns only the QBER's of the two qubits and their average. 

Hbin.m gives the binary Shannon entropy. 

eeqkdrate4.m gives the relative key rate according to Eq. (3.6) for the given gate 
parameters, q, and noise amplitude. Assumes 50% qubit loss. The slope s is 
maximized. 

eeqkdmaxmaxkeyrate4.m maximizes the relative key rate for the given noise 
amplitude over the parameters c. 

optimrate4.m optimizes the relative key rate for different BB84 QBER's. 

qber.nb contains calculations and plots regarding the key rate with noise and loss. 

secret-key _rate.nb includes commands to produce the plots in Figs. 3.1 and 3.2. 
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eprattack.nb contains calculations needed in the analysis of the entanglement- 
enhanced attacks discussed in Ch. 4. 
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